@unifiedcommerce/core 0.0.1

package/dist/interfaces/rest/routes/orders.js

@@ -0,0 +1,64 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { changeOrderStatusRoute, listOrdersRoute, getOrderRoute, getOrderFulfillmentsRoute } from "../schemas/orders";
+import { isUUID, mapErrorToResponse, mapErrorToStatus, parsePagination } from "../utils";
+export function orderRoutes(kernel) {
+    const router = new OpenAPIHono();
+    // @ts-expect-error -- openapi handler union return type
+    router.openapi(listOrdersRoute, async (c) => {
+        const pagination = parsePagination(c.req.query());
+        const status = c.req.query("status");
+        const result = await kernel.services.orders.list({
+            page: pagination.page,
+            limit: pagination.limit,
+            ...(status !== undefined ? { status } : {}),
+        }, c.get("actor"));
+        if (!result.ok)
+            return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+        return c.json({
+            data: result.value.items,
+            meta: {
+                pagination: result.value.pagination,
+            },
+        });
+    });
+    // @ts-expect-error -- openapi handler union return type
+    router.openapi(getOrderRoute, async (c) => {
+        const idOrNumber = c.req.param("idOrNumber");
+        const result = isUUID(idOrNumber)
+            ? await kernel.services.orders.getById(idOrNumber, c.get("actor"))
+            : await kernel.services.orders.getByNumber(idOrNumber, c.get("actor"));
+        if (!result.ok)
+            return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+        return c.json({ data: result.value });
+    });
+    // @ts-expect-error -- openapi() enforces strict response typing but our handler
+    // returns union responses (200 | 400 | 404). The route definition documents the
+    // contract; the handler returns dynamic status.
+    router.openapi(changeOrderStatusRoute, async (c) => {
+        const body = c.req.valid("json");
+        const result = await kernel.services.orders.changeStatus({
+            orderId: c.req.param("id"),
+            newStatus: body.status,
+            ...(body.reason !== undefined ? { reason: body.reason } : {}),
+        }, c.get("actor"));
+        if (!result.ok)
+            return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+        return c.json({ data: result.value });
+    });
+    // @ts-expect-error -- openapi handler union return type
+    router.openapi(getOrderFulfillmentsRoute, async (c) => {
+        const orderId = c.req.param("id");
+        const actor = c.get("actor");
+        // Verify the order exists and the actor has access before returning fulfillments
+        const orderResult = isUUID(orderId)
+            ? await kernel.services.orders.getById(orderId, actor)
+            : await kernel.services.orders.getByNumber(orderId, actor);
+        if (!orderResult.ok)
+            return c.json(mapErrorToResponse(orderResult.error), mapErrorToStatus(orderResult.error));
+        const result = await kernel.services.fulfillment.getByOrderId(orderResult.value.id);
+        if (!result.ok)
+            return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+        return c.json({ data: result.value });
+    });
+    return router;
+}

package/dist/interfaces/rest/routes/payments.d.ts

@@ -0,0 +1,5 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import type { Kernel } from "../../../runtime/kernel";
+import { type AppEnv } from "../utils";
+export declare function paymentRoutes(kernel: Kernel): OpenAPIHono<AppEnv, {}, "/">;
+//# sourceMappingURL=payments.d.ts.map

package/dist/interfaces/rest/routes/payments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payments.d.ts","sourceRoot":"","sources":["../../../../src/interfaces/rest/routes/payments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,KAAK,MAAM,EAAwC,MAAM,UAAU,CAAC;AAK7E,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,gCAmD3C"}

package/dist/interfaces/rest/routes/payments.js

@@ -0,0 +1,45 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { mapErrorToResponse, mapErrorToStatus } from "../utils";
+import { processedWebhookEvents } from "../../../modules/webhooks/schema";
+export function paymentRoutes(kernel) {
+    const router = new OpenAPIHono();
+    router.post("/webhook", async (c) => {
+        const result = await kernel.services.payments.verifyWebhook(c.req.raw);
+        if (!result.ok) {
+            return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+        }
+        const event = result.value;
+        const db = kernel.database.db;
+        // Atomic idempotency: INSERT ... ON CONFLICT DO NOTHING ... RETURNING
+        // If the row already exists, RETURNING yields zero rows → duplicate.
+        // If the row is new, RETURNING yields one row → process the event.
+        // No TOCTOU race: the UNIQUE constraint on event_id is the single source of truth.
+        const [inserted] = await db
+            .insert(processedWebhookEvents)
+            .values({
+            eventId: event.id,
+            provider: "stripe",
+            eventType: event.type,
+        })
+            .onConflictDoNothing()
+            .returning({ id: processedWebhookEvents.id });
+        if (!inserted) {
+            // Row already existed — this is a duplicate delivery
+            return c.json({ data: { received: true, duplicate: true } });
+        }
+        // Process the event (first time only)
+        if (event.type === "payment_intent.succeeded") {
+            const data = event.data;
+            const metadata = data?.metadata;
+            if (typeof metadata?.orderId === "string") {
+                await kernel.services.orders.changeStatus({
+                    orderId: metadata.orderId,
+                    newStatus: "confirmed",
+                    reason: "stripe_webhook_payment_intent_succeeded",
+                }, null);
+            }
+        }
+        return c.json({ data: { received: true } });
+    });
+    return router;
+}

package/dist/interfaces/rest/routes/pricing.d.ts

@@ -0,0 +1,5 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import type { Kernel } from "../../../runtime/kernel";
+import { type AppEnv } from "../utils";
+export declare function pricingRoutes(kernel: Kernel): OpenAPIHono<AppEnv, {}, "/">;
+//# sourceMappingURL=pricing.d.ts.map

package/dist/interfaces/rest/routes/pricing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pricing.d.ts","sourceRoot":"","sources":["../../../../src/interfaces/rest/routes/pricing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAAE,KAAK,MAAM,EAAqD,MAAM,UAAU,CAAC;AAE1F,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,gCAmD3C"}

package/dist/interfaces/rest/routes/pricing.js

@@ -0,0 +1,48 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { setBasePriceRoute, createModifierRoute, listPricesRoute } from "../schemas/pricing";
+import { mapErrorToResponse, mapErrorToStatus, requirePerm } from "../utils";
+export function pricingRoutes(kernel) {
+    const router = new OpenAPIHono();
+    router.use("/prices", requirePerm("pricing:manage"));
+    // @ts-expect-error -- openapi() enforces strict response typing but our handler
+    // returns union responses (201 | 400 | 422). The route definition documents the
+    // contract; the handler returns dynamic status.
+    router.openapi(setBasePriceRoute, async (c) => {
+        const actor = c.get("actor");
+        const result = await kernel.services.pricing.setBasePrice(c.req.valid("json"), actor);
+        if (!result.ok) {
+            return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+        }
+        return c.json({ data: result.value }, 201);
+    });
+    // @ts-expect-error -- openapi handler union return type
+    router.openapi(listPricesRoute, async (c) => {
+        const entityId = c.req.query("entityId");
+        const variantId = c.req.query("variantId");
+        const currency = c.req.query("currency");
+        const customerGroupId = c.req.query("customerGroupId");
+        const result = await kernel.services.pricing.listPrices({
+            ...(entityId !== undefined ? { entityId } : {}),
+            ...(variantId !== undefined ? { variantId } : {}),
+            ...(currency !== undefined ? { currency } : {}),
+            ...(customerGroupId !== undefined ? { customerGroupId } : {}),
+        });
+        if (!result.ok) {
+            return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+        }
+        return c.json({ data: result.value });
+    });
+    router.use("/modifiers", requirePerm("pricing:manage"));
+    // @ts-expect-error -- openapi() enforces strict response typing but our handler
+    // returns union responses (201 | 400 | 422). The route definition documents the
+    // contract; the handler returns dynamic status.
+    router.openapi(createModifierRoute, async (c) => {
+        const actor = c.get("actor");
+        const result = await kernel.services.pricing.createModifier(c.req.valid("json"), actor);
+        if (!result.ok) {
+            return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+        }
+        return c.json({ data: result.value }, 201);
+    });
+    return router;
+}

package/dist/interfaces/rest/routes/promotions.d.ts

@@ -0,0 +1,5 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import type { Kernel } from "../../../runtime/kernel";
+import { type AppEnv } from "../utils";
+export declare function promotionRoutes(kernel: Kernel): OpenAPIHono<AppEnv, {}, "/">;
+//# sourceMappingURL=promotions.d.ts.map

package/dist/interfaces/rest/routes/promotions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"promotions.d.ts","sourceRoot":"","sources":["../../../../src/interfaces/rest/routes/promotions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAAE,KAAK,MAAM,EAAqD,MAAM,UAAU,CAAC;AAG1F,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,gCAoF7C"}

package/dist/interfaces/rest/routes/promotions.js

@@ -0,0 +1,75 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { rateLimiter } from "hono-rate-limiter";
+import { createPromotionRoute, validatePromotionRoute, deactivatePromotionRoute, listActivePromotionsRoute } from "../schemas/promotions";
+import { mapErrorToResponse, mapErrorToStatus, requirePerm } from "../utils";
+import { resolveOrgId } from "../../../auth/org";
+export function promotionRoutes(kernel) {
+    const router = new OpenAPIHono();
+    // Rate limit promo code validation — prevents brute-force code enumeration
+    router.use("/validate", rateLimiter({
+        windowMs: 60 * 1000,
+        limit: 10,
+        keyGenerator: (c) => {
+            const raw = c.req.raw;
+            return raw?.socket?.remoteAddress ?? "unknown";
+        },
+    }));
+    router.use("/", requirePerm("promotions:manage"));
+    // @ts-expect-error -- openapi() enforces strict response typing but our handler
+    // returns union responses (201 | 400 | 422). The route definition documents the
+    // contract; the handler returns dynamic status.
+    router.openapi(createPromotionRoute, async (c) => {
+        const body = c.req.valid("json");
+        const actor = c.get("actor");
+        const result = await kernel.services.promotions.create(body, actor);
+        if (!result.ok) {
+            return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+        }
+        return c.json({ data: result.value }, 201);
+    });
+    // List active promotions — requires auth
+    router.use("/active", requirePerm("promotions:read"));
+    // @ts-expect-error -- openapi handler union return type
+    router.openapi(listActivePromotionsRoute, async (_c) => {
+        const actor = _c.get("actor");
+        const result = await kernel.services.promotions.listActive(actor);
+        if (!result.ok) {
+            return _c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+        }
+        return _c.json({ data: result.value });
+    });
+    // @ts-expect-error -- openapi() enforces strict response typing but our handler
+    // returns union responses (200 | 400 | 404). The route definition documents the
+    // contract; the handler returns dynamic status.
+    router.openapi(validatePromotionRoute, async (c) => {
+        const payload = c.req.valid("json");
+        const actor = c.get("actor");
+        const orgId = resolveOrgId(actor);
+        const result = await kernel.services.promotions.validate(payload.code, {
+            orgId,
+            currency: payload.currency,
+            subtotal: payload.subtotal,
+            lineItems: payload.lineItems,
+            ...(payload.customerId !== undefined ? { customerId: payload.customerId } : {}),
+            ...(payload.customerGroupIds !== undefined ? { customerGroupIds: payload.customerGroupIds } : {}),
+        });
+        if (!result.ok) {
+            return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+        }
+        return c.json({ data: result.value });
+    });
+    router.use("/:id/deactivate", requirePerm("promotions:manage"));
+    // @ts-expect-error -- openapi() enforces strict response typing but our handler
+    // returns union responses (200 | 400 | 404). The route definition documents the
+    // contract; the handler returns dynamic status.
+    router.openapi(deactivatePromotionRoute, async (c) => {
+        const actor = c.get("actor");
+        const orgId = resolveOrgId(actor);
+        const result = await kernel.services.promotions.deactivate(orgId, c.req.param("id"));
+        if (!result.ok) {
+            return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+        }
+        return c.json({ data: result.value });
+    });
+    return router;
+}

package/dist/interfaces/rest/routes/search.d.ts

@@ -0,0 +1,5 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import type { Kernel } from "../../../runtime/kernel";
+import { type AppEnv } from "../utils";
+export declare function searchRoutes(kernel: Kernel): OpenAPIHono<AppEnv, {}, "/">;
+//# sourceMappingURL=search.d.ts.map

package/dist/interfaces/rest/routes/search.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../../src/interfaces/rest/routes/search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAAE,KAAK,MAAM,EAAwC,MAAM,UAAU,CAAC;AAE7E,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,gCAiE1C"}

package/dist/interfaces/rest/routes/search.js

@@ -0,0 +1,60 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { searchRoute, suggestRoute } from "../schemas/search";
+import { mapErrorToResponse, mapErrorToStatus } from "../utils";
+export function searchRoutes(kernel) {
+    const router = new OpenAPIHono();
+    // @ts-expect-error -- openapi handler union return type
+    router.openapi(searchRoute, async (c) => {
+        const q = c.req.query("q") ?? "";
+        const type = c.req.query("type");
+        const category = c.req.query("category");
+        const brand = c.req.query("brand");
+        const status = c.req.query("status");
+        const page = Number.parseInt(c.req.query("page") ?? "1", 10);
+        const limit = Number.parseInt(c.req.query("limit") ?? "20", 10);
+        const facets = (c.req.query("facets") ?? "")
+            .split(",")
+            .map((facet) => facet.trim())
+            .filter(Boolean);
+        const result = await kernel.services.search.query({
+            query: q,
+            page,
+            limit,
+            filters: {
+                ...(type ? { type } : {}),
+                ...(category ? { category } : {}),
+                ...(brand ? { brand } : {}),
+                ...(status ? { status } : {}),
+            },
+            ...(facets.length > 0 ? { facets } : {}),
+        }, { actor: c.get("actor"), tx: null, requestId: "" });
+        if (!result.ok) {
+            return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+        }
+        return c.json({
+            data: result.value.hits,
+            meta: {
+                total: result.value.total,
+                page: result.value.page,
+                limit: result.value.limit,
+                facets: result.value.facets,
+            },
+        });
+    });
+    // @ts-expect-error -- openapi handler union return type
+    router.openapi(suggestRoute, async (c) => {
+        const prefix = c.req.query("prefix") ?? "";
+        const type = c.req.query("type");
+        const limit = Number.parseInt(c.req.query("limit") ?? "10", 10);
+        const result = await kernel.services.search.suggest({
+            prefix,
+            ...(type ? { type } : {}),
+            limit,
+        }, { actor: c.get("actor"), tx: null, requestId: "" });
+        if (!result.ok) {
+            return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+        }
+        return c.json({ data: result.value });
+    });
+    return router;
+}

package/dist/interfaces/rest/routes/webhooks.d.ts

@@ -0,0 +1,5 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import type { Kernel } from "../../../runtime/kernel";
+import { type AppEnv } from "../utils";
+export declare function webhookRoutes(kernel: Kernel): OpenAPIHono<AppEnv, {}, "/">;
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/interfaces/rest/routes/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../../../src/interfaces/rest/routes/webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAAE,KAAK,MAAM,EAAqD,MAAM,UAAU,CAAC;AAE1F,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,gCAwC3C"}

package/dist/interfaces/rest/routes/webhooks.js

@@ -0,0 +1,39 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { createWebhookEndpointRoute, listWebhookEndpointsRoute, deleteWebhookEndpointRoute } from "../schemas/webhooks";
+import { mapErrorToResponse, mapErrorToStatus, requirePerm } from "../utils";
+export function webhookRoutes(kernel) {
+    const router = new OpenAPIHono();
+    router.use("/*", requirePerm("webhooks:manage"));
+    // @ts-expect-error -- openapi handler union return type
+    router.openapi(createWebhookEndpointRoute, async (c) => {
+        const body = c.req.valid("json");
+        // Generate a default secret if none provided (Zod schema marks it optional for API convenience)
+        if (!body.secret) {
+            body.secret = `whsec_${crypto.randomUUID().replace(/-/g, "")}`;
+        }
+        const actor = c.get("actor");
+        const result = await kernel.services.webhooks.createEndpoint(body, actor);
+        if (!result.ok) {
+            return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+        }
+        return c.json({ data: result.value }, 201);
+    });
+    // @ts-expect-error -- openapi handler union return type
+    router.openapi(listWebhookEndpointsRoute, async (c) => {
+        const result = await kernel.services.webhooks.listEndpoints();
+        if (!result.ok) {
+            return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+        }
+        const sanitized = result.value.map(({ secret: _secret, ...rest }) => rest);
+        return c.json({ data: sanitized });
+    });
+    // @ts-expect-error -- openapi handler union return type
+    router.openapi(deleteWebhookEndpointRoute, async (c) => {
+        const result = await kernel.services.webhooks.deleteEndpoint(c.req.param("id"));
+        if (!result.ok) {
+            return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+        }
+        return c.json({ data: { deleted: true } });
+    });
+    return router;
+}